                                   :volume_size 35
                                   },
                     :snapshot_options { :automated_snapshot_start_hour 23}})
+
+     (vpc-resource "aws_iam_role" "logstash" {:name "logstash"
+                                              :assume_role_policy (json/generate-string {
+                                                                                         "Version" "2012-10-17",
+                                                                                         "Statement" [
+                                                                                                      {
+                                                                                                       "Action" "sts:AssumeRole",
+                                                                                                       "Principal" {
+                                                                                                                    "Service" "ec2.amazonaws.com"
+                                                                                                                    },
+                                                                                                       "Effect" "Allow",
+                                                                                                       "Sid" ""}]})})
+
+     (vpc-resource "aws_iam_role_policy" "logstash"
+                   {"name" "logstash"
+                    "role"  (vpc-id-of "aws_iam_role" "logstash")
+                    "policy" (json/generate-string {
+                                                    "Version" "2012-10-17"
+                                                    "Statement" [{
+                                                                  "Resource" es-arn-*,
+                                                                  "Action" ["es:*"],
+                                                                  "Effect" "Allow"
+                                                                  }
+                                                                 {
+                                                                  "Resource" es-arn,
+                                                                  "Action" ["es:*"],
+                                                                  "Effect" "Allow"
+                                                                  }
+                                                                 ]})})
+
+     (vpc-resource "aws_iam_instance_profile" "logstash" {
+                                                          :name "logstash"
+                                                          :roles  [(vpc-output-of "aws_iam_role" "logstash" "name")]
+                                                          })
+
      (add-key-name-to-instances
       key-name
       (in-vpc (id-of "aws_vpc" vpc-name)

        vpc-id-of (id-of-fn vpc-unique)
        vpc-output-of (output-of-fn vpc-unique)
        vpc-security-group (partial scoped-security-group vpc-unique)
        elb-listener (account-elb-listener account-number
                                           )]
    (merge-in
     (template-file (vpc-unique "elasticearch-policy")
                    (elasticsearch-policy)
                    {:es-arn (str "arn:aws:es:" region ":" account-number ":domain/" vpc-name "-elasticsearch/*")
                     :allowed-ips  (vpc-output-of "aws_eip" "logstash" "public_ip")})

     (vpc-resource "aws_elasticsearch_domain" name
                   {:domain_name (vpc-unique name)
                    :advanced_options { "rest.action.multi.allow_explicit_index" true}
                    :access_policies ""#_(rendered-template-file (vpc-unique "elasticsearch-policy"))

                    :cluster_config {:instance_count 2,
                                     :instance_type "t2.small.elasticsearch"}
                    :ebs_options {:ebs_enabled true,

                                                   :subnet_id (vpc-id-of "aws_subnet" "private-a")
                                                   :associate_public_ip_address true
                                                   })

              (elb "kibana" resource {:name "kibana"
                                      :health_check {:healthy_threshold 2
